Re: Vuln Scanner for Web App Source Code

[Jason <securitux () gmail com>]

Fortify and Ounce both have source code scanners and both are quite
capable (at least seem to be). I am in the middle of trying to figure
out which one to use for our source code analysis projects.

Cenzic Hailstorm and SPI Dynamics Web Inspect are vulnerability
scanners ONLY and do NOT inspect source code. Same with Paros Proxy,
this is a pen testing / VA tool more than anything.

I'd still recommend you do manual checks in addition to using a source
code scanner. You'll have to to verify the results.

-J

On 18 May 2008 04:15:50 -0000, cnanne () gmail com <cnanne () gmail com> wrote:
> This might be a bit of a dumb question, but does anyone know of a good Vulnerability Scanner for finding faults in 
> the actual Source Code of the Web App? Or can this task can only be done by hand?
>
>
> Any feedback on this is highly appreciative
>
>
>
> cheers,
>
>
> PhoenixRbrth
>
> ------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Top 5 Common Mistakes
> in Securing Web Applications
> Find out now! Get Webinar Recording and PPT Slides
>
> www.cenzic.com/landing/securityfocus/hackinar
> ------------------------------------------------------------------------

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Top 5 Common Mistakes 
in Securing Web Applications  
Find out now! Get Webinar Recording and PPT Slides

www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------